
 <!DOCTYPE HTML>
<html>
<head><meta name="generator" content="Hexo 3.9.0">
  <meta charset="UTF-8">
  
    <title>Kubernetes 1.8 集群网络 | Zong&#39;s blog</title>
    <meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=3, minimum-scale=1">
    
    <meta name="author" content="Zong">
    
    <meta name="description" content="Kubernetes的网络模型假设所有pods都处在一个可以互通的二层网络，这在GCE、AWS等云端是天然实现的。但是我们自己搭建的集群就不可能了，所以需要通过第三方的网络组件实现不同物理机上的pods网络互通。基本上开源的网络组件有Flannel、waves、Open vSwitch和Calico">
    
    
    
    
    
    <link rel="icon" href="/img/favicon.ico">
    
    
    <link rel="apple-touch-icon" href="/img/pacman.jpg">
    <link rel="apple-touch-icon-precomposed" href="/img/pacman.jpg">
    
    <link rel="stylesheet" href="/css/style.css">
</head>
</html>
  <body>
    <header>
      <div>
		
			<div id="imglogo">
				<a href="/"><img src="/img/logo.svg" alt="Zong&#39;s blog" title="Zong&#39;s blog"/></a>
			</div>
			
			<div id="textlogo">
				<h1 class="site-name"><a href="/" title="Zong&#39;s blog">Zong&#39;s blog</a></h1>
				<h2 class="blog-motto">日常积累，技术分享</h2>
			</div>
			<div class="navbar"><a class="navbutton navmobile" href="#" title="Menu">
			</a></div>
			<nav class="animated">
				<ul>
					<ul>
					 
						<li><a href="/">Home</a></li>
					
						<li><a href="/archives">Archives</a></li>
					
						<li><a href="/categories/运维">运维</a></li>
					
						<li><a href="/categories/容器架构">容器架构</a></li>
					
					<li>
					
					<form class="search" action="//baidu.com/s" method="get" accept-charset="utf-8">
						<label>Search</label>
						<input type="text" id="search" name="wd" autocomplete="off" maxlength="20" placeholder="Search" />
                        <input name=tn type=hidden value="bds">
                        <input name=cl type=hidden value="3">
                        <input name=ct type=hidden value="2097152">
						<input type="hidden" name="si" value="www.lstop.pub">
					</form>
					
					</li>
				</ul>
			</nav>			
</div>

    </header>
    <div id="container">
      <div id="main" class="post" itemscope itemprop="blogPost">
	<article itemprop="articleBody"> 
		<header class="article-info clearfix">
  <h1 itemprop="name">
    
      <a href="/2017/12/13/Kubernetes-1-8-集群网络/" title="Kubernetes 1.8 集群网络" itemprop="url">Kubernetes 1.8 集群网络</a>
  </h1>
  <p class="article-author">By
    
      <a href="http://www.lstop.pub" title="Zong">Zong</a>
    </p>
  <p class="article-time">
    <time datetime="2017-12-13T02:47:43.000Z" itemprop="datePublished">2017-12-13</time>
    
  </p>
</header>

	<div class="article-content">
		
		
		<div id="toc" class="toc-article">
			<strong class="toc-title">Contents</strong>
		
		</div>
		
		<p>Kubernetes的网络模型假设所有pods都处在一个可以互通的二层网络，这在GCE、AWS等云端是天然实现的。但是我们自己搭建的集群就不可能了，所以需要通过第三方的网络组件实现不同物理机上的pods网络互通。<br>基本上开源的网络组件有Flannel、waves、Open vSwitch和Calico，Flannel和waves的实现方式是模拟一个大二层网络（Overlay Network），通过网桥把数据包封装、解封的方式发送到目标pods。Calico的实现方式是三层路由方案，它在每个物理机实现一个vRouter转发数据包，通过网桥把数据包封装、解封的方式发送到目标pods。</p>
<p>本次选择Calico搭建网络，安装需满足以下条件：</p>
<ul>
<li>kubelet需要配置使用CNI网络插件 (e.g –network-plugin=cni)</li>
<li>kube-apiserver、kubelet需要配置特权模式参数 –allow_privileged=true</li>
<li>kube-proxy 不能使用–masquerade-all 参数</li>
<li>kubernetes版本个人推荐1.6以上</li>
</ul>
<p>安装calico在kubernetes 1.6以上并不复杂，官方有yaml配置，下载下来改一下参数就能直接使用kubectl生成容器。calico node会以DaemonSet 形式部署在每一台kube node上。<br>下载<a href="https://docs.projectcalico.org/v3.0/getting-started/kubernetes/installation/hosted/calico.yaml" target="_blank" rel="noopener">calico.yaml</a>配置模板并修改内容。</p>
<ol>
<li><p>分配给Pod的IP段<br>默认ip段如果与当前已有ip冲突，可以修改 CALICO_IPV4POOL_CIDR 部分</p>
</li>
<li><p>配置IP-in-IP<br>IP-in-IP默认开启，采用teunl方式跨子网，以下几种情况可以关闭IPIP（CALICO_IPV4POOL_IPIP 设置OFF）</p>
<blockquote>
<p>运行在aws<br>所有kubernetes node运行在同一个L2网络<br>使用BGP方式让Pod IP在底层通信</p>
</blockquote>
</li>
<li><p>设置etcd<br>etcd作用是存储ip和policy策略，默认不使用ssl通信，没有认证。<br>修改参数etcd_endpoints为正确的etcd地址。</p>
</li>
<li><p>设置kubeconfig</p>
</li>
<li><p>k8s_api_root<br>填写ClusterIP的第一个地址，使用sudo kubectl get svc查看</p>
</li>
</ol>
<p>完成后使用 kubectl apply -f calico.yaml 命令就能安装好calico</p>
<p>完整的<strong>calico.yaml</strong></p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br><span class="line">71</span><br><span class="line">72</span><br><span class="line">73</span><br><span class="line">74</span><br><span class="line">75</span><br><span class="line">76</span><br><span class="line">77</span><br><span class="line">78</span><br><span class="line">79</span><br><span class="line">80</span><br><span class="line">81</span><br><span class="line">82</span><br><span class="line">83</span><br><span class="line">84</span><br><span class="line">85</span><br><span class="line">86</span><br><span class="line">87</span><br><span class="line">88</span><br><span class="line">89</span><br><span class="line">90</span><br><span class="line">91</span><br><span class="line">92</span><br><span class="line">93</span><br><span class="line">94</span><br><span class="line">95</span><br><span class="line">96</span><br><span class="line">97</span><br><span class="line">98</span><br><span class="line">99</span><br><span class="line">100</span><br><span class="line">101</span><br><span class="line">102</span><br><span class="line">103</span><br><span class="line">104</span><br><span class="line">105</span><br><span class="line">106</span><br><span class="line">107</span><br><span class="line">108</span><br><span class="line">109</span><br><span class="line">110</span><br><span class="line">111</span><br><span class="line">112</span><br><span class="line">113</span><br><span class="line">114</span><br><span class="line">115</span><br><span class="line">116</span><br><span class="line">117</span><br><span class="line">118</span><br><span class="line">119</span><br><span class="line">120</span><br><span class="line">121</span><br><span class="line">122</span><br><span class="line">123</span><br><span class="line">124</span><br><span class="line">125</span><br><span class="line">126</span><br><span class="line">127</span><br><span class="line">128</span><br><span class="line">129</span><br><span class="line">130</span><br><span class="line">131</span><br><span class="line">132</span><br><span class="line">133</span><br><span class="line">134</span><br><span class="line">135</span><br><span class="line">136</span><br><span class="line">137</span><br><span class="line">138</span><br><span class="line">139</span><br><span class="line">140</span><br><span class="line">141</span><br><span class="line">142</span><br><span class="line">143</span><br><span class="line">144</span><br><span class="line">145</span><br><span class="line">146</span><br><span class="line">147</span><br><span class="line">148</span><br><span class="line">149</span><br><span class="line">150</span><br><span class="line">151</span><br><span class="line">152</span><br><span class="line">153</span><br><span class="line">154</span><br><span class="line">155</span><br><span class="line">156</span><br><span class="line">157</span><br><span class="line">158</span><br><span class="line">159</span><br><span class="line">160</span><br><span class="line">161</span><br><span class="line">162</span><br><span class="line">163</span><br><span class="line">164</span><br><span class="line">165</span><br><span class="line">166</span><br><span class="line">167</span><br><span class="line">168</span><br><span class="line">169</span><br><span class="line">170</span><br><span class="line">171</span><br><span class="line">172</span><br><span class="line">173</span><br><span class="line">174</span><br><span class="line">175</span><br><span class="line">176</span><br><span class="line">177</span><br><span class="line">178</span><br><span class="line">179</span><br><span class="line">180</span><br><span class="line">181</span><br><span class="line">182</span><br><span class="line">183</span><br><span class="line">184</span><br><span class="line">185</span><br><span class="line">186</span><br><span class="line">187</span><br><span class="line">188</span><br><span class="line">189</span><br><span class="line">190</span><br><span class="line">191</span><br><span class="line">192</span><br><span class="line">193</span><br><span class="line">194</span><br><span class="line">195</span><br><span class="line">196</span><br><span class="line">197</span><br><span class="line">198</span><br><span class="line">199</span><br><span class="line">200</span><br><span class="line">201</span><br><span class="line">202</span><br><span class="line">203</span><br><span class="line">204</span><br><span class="line">205</span><br><span class="line">206</span><br><span class="line">207</span><br><span class="line">208</span><br><span class="line">209</span><br><span class="line">210</span><br><span class="line">211</span><br><span class="line">212</span><br><span class="line">213</span><br><span class="line">214</span><br><span class="line">215</span><br><span class="line">216</span><br><span class="line">217</span><br><span class="line">218</span><br><span class="line">219</span><br><span class="line">220</span><br><span class="line">221</span><br><span class="line">222</span><br><span class="line">223</span><br><span class="line">224</span><br><span class="line">225</span><br><span class="line">226</span><br><span class="line">227</span><br><span class="line">228</span><br><span class="line">229</span><br><span class="line">230</span><br><span class="line">231</span><br><span class="line">232</span><br><span class="line">233</span><br><span class="line">234</span><br><span class="line">235</span><br><span class="line">236</span><br><span class="line">237</span><br><span class="line">238</span><br><span class="line">239</span><br><span class="line">240</span><br><span class="line">241</span><br><span class="line">242</span><br><span class="line">243</span><br><span class="line">244</span><br><span class="line">245</span><br><span class="line">246</span><br><span class="line">247</span><br><span class="line">248</span><br><span class="line">249</span><br><span class="line">250</span><br><span class="line">251</span><br><span class="line">252</span><br><span class="line">253</span><br><span class="line">254</span><br><span class="line">255</span><br><span class="line">256</span><br><span class="line">257</span><br><span class="line">258</span><br><span class="line">259</span><br><span class="line">260</span><br><span class="line">261</span><br><span class="line">262</span><br><span class="line">263</span><br><span class="line">264</span><br><span class="line">265</span><br><span class="line">266</span><br><span class="line">267</span><br><span class="line">268</span><br><span class="line">269</span><br><span class="line">270</span><br><span class="line">271</span><br><span class="line">272</span><br><span class="line">273</span><br><span class="line">274</span><br><span class="line">275</span><br><span class="line">276</span><br><span class="line">277</span><br><span class="line">278</span><br><span class="line">279</span><br><span class="line">280</span><br><span class="line">281</span><br><span class="line">282</span><br><span class="line">283</span><br><span class="line">284</span><br><span class="line">285</span><br><span class="line">286</span><br><span class="line">287</span><br><span class="line">288</span><br><span class="line">289</span><br><span class="line">290</span><br><span class="line">291</span><br><span class="line">292</span><br><span class="line">293</span><br><span class="line">294</span><br><span class="line">295</span><br><span class="line">296</span><br><span class="line">297</span><br><span class="line">298</span><br><span class="line">299</span><br><span class="line">300</span><br><span class="line">301</span><br><span class="line">302</span><br><span class="line">303</span><br><span class="line">304</span><br><span class="line">305</span><br><span class="line">306</span><br><span class="line">307</span><br><span class="line">308</span><br><span class="line">309</span><br><span class="line">310</span><br><span class="line">311</span><br><span class="line">312</span><br><span class="line">313</span><br><span class="line">314</span><br><span class="line">315</span><br><span class="line">316</span><br><span class="line">317</span><br><span class="line">318</span><br><span class="line">319</span><br><span class="line">320</span><br><span class="line">321</span><br><span class="line">322</span><br><span class="line">323</span><br><span class="line">324</span><br><span class="line">325</span><br><span class="line">326</span><br><span class="line">327</span><br><span class="line">328</span><br><span class="line">329</span><br><span class="line">330</span><br><span class="line">331</span><br><span class="line">332</span><br><span class="line">333</span><br><span class="line">334</span><br><span class="line">335</span><br><span class="line">336</span><br><span class="line">337</span><br><span class="line">338</span><br><span class="line">339</span><br><span class="line">340</span><br></pre></td><td class="code"><pre><span class="line"># Calico Version v3.0.4</span><br><span class="line"># https://docs.projectcalico.org/v3.0/releases#v3.0.4</span><br><span class="line"># This manifest includes the following component versions:</span><br><span class="line">#   calico/node:v3.0.4</span><br><span class="line">#   calico/cni:v2.0.3</span><br><span class="line">#   calico/kube-controllers:v2.0.2</span><br><span class="line"># This ConfigMap is used to configure a self-hosted Calico installation.</span><br><span class="line">kind: ConfigMap</span><br><span class="line">apiVersion: v1</span><br><span class="line">metadata:</span><br><span class="line">  name: calico-config</span><br><span class="line">  namespace: kube-system</span><br><span class="line">data:</span><br><span class="line">  # Configure this with the location of your etcd cluster.</span><br><span class="line">  etcd_endpoints: &quot;http://192.168.21.66:2379&quot;</span><br><span class="line">  # Configure the Calico backend to use.</span><br><span class="line">  calico_backend: &quot;bird&quot;</span><br><span class="line">  # The CNI network configuration to install on each node.</span><br><span class="line">  cni_network_config: |-</span><br><span class="line">    &#123;</span><br><span class="line">      &quot;name&quot;: &quot;k8s-pod-network&quot;,</span><br><span class="line">      &quot;cniVersion&quot;: &quot;0.3.0&quot;,</span><br><span class="line">      &quot;plugins&quot;: [</span><br><span class="line">        &#123;</span><br><span class="line">            &quot;type&quot;: &quot;calico&quot;,</span><br><span class="line">            &quot;etcd_endpoints&quot;: &quot;http://192.168.21.66:2379&quot;,</span><br><span class="line">            &quot;etcd_key_file&quot;: &quot;&quot;,</span><br><span class="line">            &quot;etcd_cert_file&quot;: &quot;&quot;,</span><br><span class="line">            &quot;etcd_ca_cert_file&quot;: &quot;&quot;,</span><br><span class="line">            &quot;log_level&quot;: &quot;info&quot;,</span><br><span class="line">            &quot;mtu&quot;: 1500,</span><br><span class="line">            &quot;ipam&quot;: &#123;</span><br><span class="line">                &quot;type&quot;: &quot;calico-ipam&quot;</span><br><span class="line">            &#125;,</span><br><span class="line">            &quot;policy&quot;: &#123;</span><br><span class="line">                &quot;type&quot;: &quot;k8s&quot;,</span><br><span class="line">                &quot;k8s_api_root&quot;: &quot;https://169.169.0.1:443&quot;,</span><br><span class="line">                &quot;k8s_auth_token&quot;: &quot;&quot;</span><br><span class="line">            &#125;,</span><br><span class="line">            &quot;kubernetes&quot;: &#123;</span><br><span class="line">                &quot;kubeconfig&quot;: &quot;/etc/kubernetes/kubeconfig&quot;</span><br><span class="line">            &#125;</span><br><span class="line">        &#125;,</span><br><span class="line">        &#123;</span><br><span class="line">          &quot;type&quot;: &quot;portmap&quot;,</span><br><span class="line">          &quot;snat&quot;: true,</span><br><span class="line">          &quot;capabilities&quot;: &#123;&quot;portMappings&quot;: true&#125;</span><br><span class="line">        &#125;</span><br><span class="line">      ]</span><br><span class="line">    &#125;</span><br><span class="line">  # If you&apos;re using TLS enabled etcd uncomment the following.</span><br><span class="line">  # You must also populate the Secret below with these files.</span><br><span class="line">  etcd_ca: &quot;&quot;   # &quot;/calico-secrets/etcd-ca&quot;</span><br><span class="line">  etcd_cert: &quot;&quot; # &quot;/calico-secrets/etcd-cert&quot;</span><br><span class="line">  etcd_key: &quot;&quot;  # &quot;/calico-secrets/etcd-key&quot;</span><br><span class="line">---</span><br><span class="line"># The following contains k8s Secrets for use with a TLS enabled etcd cluster.</span><br><span class="line"># For information on populating Secrets, see http://kubernetes.io/docs/user-guide/secrets/</span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: Secret</span><br><span class="line">type: Opaque</span><br><span class="line">metadata:</span><br><span class="line">  name: calico-etcd-secrets</span><br><span class="line">  namespace: kube-system</span><br><span class="line">data:</span><br><span class="line">  # Populate the following files with etcd TLS configuration if desired, but leave blank if</span><br><span class="line">  # not using TLS for etcd.</span><br><span class="line">  # This self-hosted install expects three files with the following names.  The values</span><br><span class="line">  # should be base64 encoded strings of the entire contents of each file.</span><br><span class="line">  # etcd-key: null</span><br><span class="line">  # etcd-cert: null</span><br><span class="line">  # etcd-ca: null</span><br><span class="line">---</span><br><span class="line"># This manifest installs the calico/node container, as well</span><br><span class="line"># as the Calico CNI plugins and network config on</span><br><span class="line"># each master and worker node in a Kubernetes cluster.</span><br><span class="line">kind: DaemonSet</span><br><span class="line">apiVersion: extensions/v1beta1</span><br><span class="line">metadata:</span><br><span class="line">  name: calico-node</span><br><span class="line">  namespace: kube-system</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: calico-node</span><br><span class="line">spec:</span><br><span class="line">  selector:</span><br><span class="line">    matchLabels:</span><br><span class="line">      k8s-app: calico-node</span><br><span class="line">  updateStrategy:</span><br><span class="line">    type: RollingUpdate</span><br><span class="line">    rollingUpdate:</span><br><span class="line">      maxUnavailable: 1</span><br><span class="line">  template:</span><br><span class="line">    metadata:</span><br><span class="line">      labels:</span><br><span class="line">        k8s-app: calico-node</span><br><span class="line">      annotations:</span><br><span class="line">        scheduler.alpha.kubernetes.io/critical-pod: &apos;&apos;</span><br><span class="line">    spec:</span><br><span class="line">      hostNetwork: true</span><br><span class="line">      tolerations:</span><br><span class="line">        # Make sure calico/node gets scheduled on all nodes.</span><br><span class="line">        - effect: NoSchedule</span><br><span class="line">          operator: Exists</span><br><span class="line">        # Mark the pod as a critical add-on for rescheduling.</span><br><span class="line">        - key: CriticalAddonsOnly</span><br><span class="line">          operator: Exists</span><br><span class="line">        - effect: NoExecute</span><br><span class="line">          operator: Exists</span><br><span class="line">      serviceAccountName: calico-node</span><br><span class="line">      # Minimize downtime during a rolling upgrade or deletion; tell Kubernetes to do a &quot;force</span><br><span class="line">      # deletion&quot;: https://kubernetes.io/docs/concepts/workloads/pods/pod/#termination-of-pods.</span><br><span class="line">      terminationGracePeriodSeconds: 0</span><br><span class="line">      containers:</span><br><span class="line">        # Runs calico/node container on each Kubernetes node.  This</span><br><span class="line">        # container programs network policy and routes on each</span><br><span class="line">        # host.</span><br><span class="line">        - name: calico-node</span><br><span class="line">          image: quay.io/calico/node:v3.0.4</span><br><span class="line">          env:</span><br><span class="line">            # The location of the Calico etcd cluster.</span><br><span class="line">            - name: ETCD_ENDPOINTS</span><br><span class="line">              valueFrom:</span><br><span class="line">                configMapKeyRef:</span><br><span class="line">                  name: calico-config</span><br><span class="line">                  key: etcd_endpoints</span><br><span class="line">            # Choose the backend to use.</span><br><span class="line">            - name: CALICO_NETWORKING_BACKEND</span><br><span class="line">              valueFrom:</span><br><span class="line">                configMapKeyRef:</span><br><span class="line">                  name: calico-config</span><br><span class="line">                  key: calico_backend</span><br><span class="line">            # Cluster type to identify the deployment type</span><br><span class="line">            - name: CLUSTER_TYPE</span><br><span class="line">              value: &quot;k8s,bgp&quot;</span><br><span class="line">            # Disable file logging so `kubectl logs` works.</span><br><span class="line">            - name: CALICO_DISABLE_FILE_LOGGING</span><br><span class="line">              value: &quot;true&quot;</span><br><span class="line">            # Set noderef for node controller.</span><br><span class="line">            - name: CALICO_K8S_NODE_REF</span><br><span class="line">              valueFrom:</span><br><span class="line">                fieldRef:</span><br><span class="line">                  fieldPath: spec.nodeName</span><br><span class="line">            # Set Felix endpoint to host default action to ACCEPT.</span><br><span class="line">            - name: FELIX_DEFAULTENDPOINTTOHOSTACTION</span><br><span class="line">              value: &quot;ACCEPT&quot;</span><br><span class="line">            # The default IPv4 pool to create on startup if none exists. Pod IPs will be</span><br><span class="line">            # chosen from this range. Changing this value after installation will have</span><br><span class="line">            # no effect. This should fall within `--cluster-cidr`.</span><br><span class="line">            - name: CALICO_IPV4POOL_CIDR</span><br><span class="line">              value: &quot;172.50.0.0/16&quot;</span><br><span class="line">            - name: CALICO_IPV4POOL_IPIP</span><br><span class="line">              value: &quot;cross-subnet&quot;</span><br><span class="line">            # Disable IPv6 on Kubernetes.</span><br><span class="line">            - name: FELIX_IPV6SUPPORT</span><br><span class="line">              value: &quot;false&quot;</span><br><span class="line">            # Set Felix logging to &quot;info&quot;</span><br><span class="line">            - name: FELIX_LOGSEVERITYSCREEN</span><br><span class="line">              value: &quot;info&quot;</span><br><span class="line">            # Set MTU for tunnel device used if ipip is enabled</span><br><span class="line">            - name: FELIX_IPINIPMTU</span><br><span class="line">              value: &quot;1440&quot;</span><br><span class="line">            # Location of the CA certificate for etcd.</span><br><span class="line">            - name: ETCD_CA_CERT_FILE</span><br><span class="line">              valueFrom:</span><br><span class="line">                configMapKeyRef:</span><br><span class="line">                  name: calico-config</span><br><span class="line">                  key: etcd_ca</span><br><span class="line">            # Location of the client key for etcd.</span><br><span class="line">            - name: ETCD_KEY_FILE</span><br><span class="line">              valueFrom:</span><br><span class="line">                configMapKeyRef:</span><br><span class="line">                  name: calico-config</span><br><span class="line">                  key: etcd_key</span><br><span class="line">            # Location of the client certificate for etcd.</span><br><span class="line">            - name: ETCD_CERT_FILE</span><br><span class="line">              valueFrom:</span><br><span class="line">                configMapKeyRef:</span><br><span class="line">                  name: calico-config</span><br><span class="line">                  key: etcd_cert</span><br><span class="line">            # Auto-detect the BGP IP address.</span><br><span class="line">            - name: IP</span><br><span class="line">              value: &quot;autodetect&quot;</span><br><span class="line">            - name: FELIX_HEALTHENABLED</span><br><span class="line">              value: &quot;true&quot;</span><br><span class="line">          securityContext:</span><br><span class="line">            privileged: true</span><br><span class="line">          resources:</span><br><span class="line">            requests:</span><br><span class="line">              cpu: 250m</span><br><span class="line">          livenessProbe:</span><br><span class="line">            httpGet:</span><br><span class="line">              path: /liveness</span><br><span class="line">              port: 9099</span><br><span class="line">            periodSeconds: 10</span><br><span class="line">            initialDelaySeconds: 10</span><br><span class="line">            failureThreshold: 6</span><br><span class="line">          readinessProbe:</span><br><span class="line">            httpGet:</span><br><span class="line">              path: /readiness</span><br><span class="line">              port: 9099</span><br><span class="line">            periodSeconds: 10</span><br><span class="line">          volumeMounts:</span><br><span class="line">            - mountPath: /lib/modules</span><br><span class="line">              name: lib-modules</span><br><span class="line">              readOnly: true</span><br><span class="line">            - mountPath: /var/run/calico</span><br><span class="line">              name: var-run-calico</span><br><span class="line">              readOnly: false</span><br><span class="line">            - mountPath: /calico-secrets</span><br><span class="line">              name: etcd-certs</span><br><span class="line">        # This container installs the Calico CNI binaries</span><br><span class="line">        # and CNI network config file on each node.</span><br><span class="line">        - name: install-cni</span><br><span class="line">          image: quay.io/calico/cni:v2.0.3</span><br><span class="line">          command: [&quot;/install-cni.sh&quot;]</span><br><span class="line">          env:</span><br><span class="line">            # Name of the CNI config file to create.</span><br><span class="line">            - name: CNI_CONF_NAME</span><br><span class="line">              value: &quot;10-calico.conflist&quot;</span><br><span class="line">            # The location of the Calico etcd cluster.</span><br><span class="line">            - name: ETCD_ENDPOINTS</span><br><span class="line">              valueFrom:</span><br><span class="line">                configMapKeyRef:</span><br><span class="line">                  name: calico-config</span><br><span class="line">                  key: etcd_endpoints</span><br><span class="line">            # The CNI network config to install on each node.</span><br><span class="line">            - name: CNI_NETWORK_CONFIG</span><br><span class="line">              valueFrom:</span><br><span class="line">                configMapKeyRef:</span><br><span class="line">                  name: calico-config</span><br><span class="line">                  key: cni_network_config</span><br><span class="line">          volumeMounts:</span><br><span class="line">            - mountPath: /host/opt/cni/bin</span><br><span class="line">              name: cni-bin-dir</span><br><span class="line">            - mountPath: /host/etc/cni/net.d</span><br><span class="line">              name: cni-net-dir</span><br><span class="line">            - mountPath: /calico-secrets</span><br><span class="line">              name: etcd-certs</span><br><span class="line">      volumes:</span><br><span class="line">        # Used by calico/node.</span><br><span class="line">        - name: lib-modules</span><br><span class="line">          hostPath:</span><br><span class="line">            path: /lib/modules</span><br><span class="line">        - name: var-run-calico</span><br><span class="line">          hostPath:</span><br><span class="line">            path: /var/run/calico</span><br><span class="line">        # Used to install CNI.</span><br><span class="line">        - name: cni-bin-dir</span><br><span class="line">          hostPath:</span><br><span class="line">            path: /opt/cni/bin</span><br><span class="line">        - name: cni-net-dir</span><br><span class="line">          hostPath:</span><br><span class="line">            path: /etc/cni/net.d</span><br><span class="line">        # Mount in the etcd TLS secrets.</span><br><span class="line">        - name: etcd-certs</span><br><span class="line">          secret:</span><br><span class="line">            secretName: calico-etcd-secrets</span><br><span class="line">---</span><br><span class="line"># This manifest deploys the Calico Kubernetes controllers.</span><br><span class="line"># See https://github.com/projectcalico/kube-controllers</span><br><span class="line">apiVersion: extensions/v1beta1</span><br><span class="line">kind: Deployment</span><br><span class="line">metadata:</span><br><span class="line">  name: calico-kube-controllers</span><br><span class="line">  namespace: kube-system</span><br><span class="line">  labels:</span><br><span class="line">    k8s-app: calico-kube-controllers</span><br><span class="line">  annotations:</span><br><span class="line">    scheduler.alpha.kubernetes.io/critical-pod: &apos;&apos;</span><br><span class="line">    scheduler.alpha.kubernetes.io/tolerations: |</span><br><span class="line">      [&#123;&quot;key&quot;: &quot;dedicated&quot;, &quot;value&quot;: &quot;master&quot;, &quot;effect&quot;: &quot;NoSchedule&quot; &#125;,</span><br><span class="line">       &#123;&quot;key&quot;:&quot;CriticalAddonsOnly&quot;, &quot;operator&quot;:&quot;Exists&quot;&#125;]</span><br><span class="line">spec:</span><br><span class="line">  # The controllers can only have a single active instance.</span><br><span class="line">  replicas: 1</span><br><span class="line">  strategy:</span><br><span class="line">    type: Recreate</span><br><span class="line">  template:</span><br><span class="line">    metadata:</span><br><span class="line">      name: calico-kube-controllers</span><br><span class="line">      namespace: kube-system</span><br><span class="line">      labels:</span><br><span class="line">        k8s-app: calico-kube-controllers</span><br><span class="line">    spec:</span><br><span class="line">      # The controllers must run in the host network namespace so that</span><br><span class="line">      # it isn&apos;t governed by policy that would prevent it from working.</span><br><span class="line">      hostNetwork: true</span><br><span class="line">      serviceAccountName: calico-kube-controllers</span><br><span class="line">      containers:</span><br><span class="line">        - name: calico-kube-controllers</span><br><span class="line">          image: quay.io/calico/kube-controllers:v2.0.2</span><br><span class="line">          env:</span><br><span class="line">            # The location of the Calico etcd cluster.</span><br><span class="line">            - name: ETCD_ENDPOINTS</span><br><span class="line">              valueFrom:</span><br><span class="line">                configMapKeyRef:</span><br><span class="line">                  name: calico-config</span><br><span class="line">                  key: etcd_endpoints</span><br><span class="line">            # Location of the CA certificate for etcd.</span><br><span class="line">            - name: ETCD_CA_CERT_FILE</span><br><span class="line">              valueFrom:</span><br><span class="line">                configMapKeyRef:</span><br><span class="line">                  name: calico-config</span><br><span class="line">                  key: etcd_ca</span><br><span class="line">            # Location of the client key for etcd.</span><br><span class="line">            - name: ETCD_KEY_FILE</span><br><span class="line">              valueFrom:</span><br><span class="line">                configMapKeyRef:</span><br><span class="line">                  name: calico-config</span><br><span class="line">                  key: etcd_key</span><br><span class="line">            # Location of the client certificate for etcd.</span><br><span class="line">            - name: ETCD_CERT_FILE</span><br><span class="line">              valueFrom:</span><br><span class="line">                configMapKeyRef:</span><br><span class="line">                  name: calico-config</span><br><span class="line">                  key: etcd_cert</span><br><span class="line">            # Choose which controllers to run.</span><br><span class="line">            - name: ENABLED_CONTROLLERS</span><br><span class="line">              value: policy,profile,workloadendpoint,node</span><br><span class="line">          volumeMounts:</span><br><span class="line">            # Mount in the etcd TLS secrets.</span><br><span class="line">            - mountPath: /calico-secrets</span><br><span class="line">              name: etcd-certs</span><br><span class="line">      volumes:</span><br><span class="line">        # Mount in the etcd TLS secrets.</span><br><span class="line">        - name: etcd-certs</span><br><span class="line">          secret:</span><br><span class="line">            secretName: calico-etcd-secrets</span><br><span class="line">---</span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: ServiceAccount</span><br><span class="line">metadata:</span><br><span class="line">  name: calico-kube-controllers</span><br><span class="line">  namespace: kube-system</span><br><span class="line">---</span><br><span class="line">apiVersion: v1</span><br><span class="line">kind: ServiceAccount</span><br><span class="line">metadata:</span><br><span class="line">  name: calico-node</span><br><span class="line">  namespace: kube-system</span><br></pre></td></tr></table></figure>

<blockquote>
<p>使用指定版本的calico/node，calico/cni等容器可以避免官方更新引起的前后版本不一致问题</p>
</blockquote>
<blockquote>
<p>在腾讯云等使用VPC网络的环境，需要用IPIP模式</p>
</blockquote>
  
	</div>
		<footer class="article-footer clearfix">

  <div class="article-tags">
  
  <span></span> <a href="/tags/K8s/">K8s</a>
  </div>


<div class="article-categories">
  <span></span>
  <a class="article-category-link" href="/categories/容器架构/">容器架构</a>
</div>



<div class="article-share" id="share">

  <div data-url="http://www.lstop.pub/2017/12/13/Kubernetes-1-8-集群网络/" data-title="Kubernetes 1.8 集群网络 | Zong&#39;s blog" data-tsina="" class="share clearfix">
  </div>

</div>
</footer>   	       
	</article>
	
<nav class="article-nav clearfix">
 
 <div class="prev" >
 <a href="/2018/03/13/Kubernetes-1-8-DNS服务-自定义域DNS/" title="Kubernetes 1.8 DNS服务-自定义域DNS">
  <strong>PREVIOUS:</strong><br/>
  <span>
  Kubernetes 1.8 DNS服务-自定义域DNS</span>
</a>
</div>


<div class="next">
<a href="/2017/12/04/Kubernetes-1-8-DNS服务/"  title="Kubernetes 1.8 DNS服务">
 <strong>NEXT:</strong><br/> 
 <span>Kubernetes 1.8 DNS服务
</span>
</a>
</div>

</nav>

	
</div>  
      <div class="openaside"><a class="navbutton" href="#" title="Show Sidebar"></a></div>

  <div id="toc" class="toc-aside">
  <strong class="toc-title">Contents</strong>
  
  </div>

<div id="asidepart">
<div class="closeaside"><a class="closebutton" href="#" title="Hide Sidebar"></a></div>
<aside class="clearfix">

  
<div class="tagslist">
	<p class="asidetitle">Tags</p>
		<ul class="clearfix">
		
			<li><a href="/tags/Airtest/" title="Airtest">Airtest<sup>1</sup></a></li>
		
			<li><a href="/tags/DNS/" title="DNS">DNS<sup>1</sup></a></li>
		
			<li><a href="/tags/GitLab/" title="GitLab">GitLab<sup>1</sup></a></li>
		
			<li><a href="/tags/K8s/" title="K8s">K8s<sup>8</sup></a></li>
		
			<li><a href="/tags/Linux/" title="Linux">Linux<sup>1</sup></a></li>
		
			<li><a href="/tags/MongoDB/" title="MongoDB">MongoDB<sup>2</sup></a></li>
		
			<li><a href="/tags/OpenWrt/" title="OpenWrt">OpenWrt<sup>1</sup></a></li>
		
			<li><a href="/tags/Python/" title="Python">Python<sup>2</sup></a></li>
		
			<li><a href="/tags/RabbitMQ/" title="RabbitMQ">RabbitMQ<sup>1</sup></a></li>
		
			<li><a href="/tags/calico/" title="calico">calico<sup>1</sup></a></li>
		
			<li><a href="/tags/cdn/" title="cdn">cdn<sup>1</sup></a></li>
		
			<li><a href="/tags/docker/" title="docker">docker<sup>3</sup></a></li>
		
			<li><a href="/tags/docker-registry/" title="docker registry">docker registry<sup>1</sup></a></li>
		
			<li><a href="/tags/elasticsearch/" title="elasticsearch">elasticsearch<sup>3</sup></a></li>
		
			<li><a href="/tags/elk/" title="elk">elk<sup>3</sup></a></li>
		
			<li><a href="/tags/k8s/" title="k8s">k8s<sup>3</sup></a></li>
		
			<li><a href="/tags/kubernetes/" title="kubernetes">kubernetes<sup>1</sup></a></li>
		
			<li><a href="/tags/nginx/" title="nginx">nginx<sup>1</sup></a></li>
		
			<li><a href="/tags/python/" title="python">python<sup>1</sup></a></li>
		
			<li><a href="/tags/tomcat/" title="tomcat">tomcat<sup>1</sup></a></li>
		
		</ul>
</div>


  <div class="linkslist">
  <p class="asidetitle">Links</p>
    <ul>
      <li><a href="http://www.v2ex.com/?r=zong400" target="_blank" title="V2EX">V2EX</a></li>
      <li><a href="http://hexo.io" target="_blank" title="Hexo">Hexo</a></li>
	  <li><a href="https://promotion.aliyun.com/ntms/yunparter/invite.html?userCode=s0bh6uzq" target="_blank" title="阿里云">阿里云</a></li>
	  <li><a href="https://cloud.tencent.com/redirect.php?redirect=1014&cps_key=5bd9deb84d4d9f34b65fb934e12d03e3&from=console" target="_blank" title="腾讯云">腾讯云</a></li>
    </ul>
</div>


</aside>
</div>
    </div>
    <footer><div id="footer" >
	
	
	<div class="social-font" class="clearfix">
		
		
		
		
	</div>
		<p class="copyright">Hosted by <a href="https://pages.coding.me/" target="_blank" title="Coding Pages">Coding Pages</a></p>
		<p class="copyright">Powered by <a href="http://hexo.io" target="_blank" title="hexo">hexo</a> and Theme by <a href="https://github.com/wizicer/iceman" target="_blank" title="Iceman">Iceman</a> © 2020 
		
		<a href="http://www.lstop.pub" target="_blank" title="Zong">Zong</a>
		
		</p>
</div>
</footer>
    <script src="//cdn.staticfile.org/jquery/2.1.0/jquery.min.js"></script>
<script type="text/javascript">
$(document).ready(function(){ 
  $('.navbar').click(function(){
    $('header nav').toggleClass('shownav');
  });
  var myWidth = 0;
  function getSize(){
    if( typeof( window.innerWidth ) == 'number' ) {
      myWidth = window.innerWidth;
    } else if( document.documentElement && document.documentElement.clientWidth) {
      myWidth = document.documentElement.clientWidth;
    };
  };
  var m = $('#main'),
      a = $('#asidepart'),
      c = $('.closeaside'),
      o = $('.openaside');
  $(window).resize(function(){
    getSize(); 
    if (myWidth >= 1024) {
      $('header nav').removeClass('shownav');
    }else
    {
      m.removeClass('moveMain');
      a.css('display', 'block').removeClass('fadeOut');
      o.css('display', 'none');
      
      $('#toc.toc-aside').css('display', 'none');
        
    }
  });
  c.click(function(){
    a.addClass('fadeOut').css('display', 'none');
    o.css('display', 'block').addClass('fadeIn');
    m.addClass('moveMain');
  });
  o.click(function(){
    o.css('display', 'none').removeClass('beforeFadeIn');
    a.css('display', 'block').removeClass('fadeOut').addClass('fadeIn');      
    m.removeClass('moveMain');
  });
  $(window).scroll(function(){
    o.css("top",Math.max(80,260-$(this).scrollTop()));
  });
});
</script>

<script type="text/javascript">
$(document).ready(function(){ 
  var ai = $('.article-content>iframe'),
      ae = $('.article-content>embed'),
      t  = $('#toc'),
      h  = $('article h2')
      ah = $('article h2'),
      ta = $('#toc.toc-aside'),
      o  = $('.openaside'),
      c  = $('.closeaside');
  if(ai.length>0){
    ai.wrap('<div class="video-container" />');
  };
  if(ae.length>0){
   ae.wrap('<div class="video-container" />');
  };
  if(ah.length==0){
    t.css('display','none');
  }else{
    c.click(function(){
      ta.css('display', 'block').addClass('fadeIn');
    });
    o.click(function(){
      ta.css('display', 'none');
    });
    $(window).scroll(function(){
      ta.css("top",Math.max(140,320-$(this).scrollTop()));
    });
  };
});
</script>


<script type="text/javascript">
$(document).ready(function(){ 
  var $this = $('.share'),
      url = $this.attr('data-url'),
      encodedUrl = encodeURIComponent(url),
      title = $this.attr('data-title'),
      tsina = $this.attr('data-tsina');
  var html = [
  '<a href="#" class="overlay" id="qrcode"></a>',
  '<div class="qrcode clearfix"><span>扫描二维码分享到微信朋友圈</span><a class="qrclose" href="#share"></a><strong>Loading...Please wait</strong><img id="qrcode-pic" data-src="http://s.jiathis.com/qrcode.php?url=' + encodedUrl + '"/></div>',
  '<a href="#textlogo" class="article-back-to-top" title="Top"></a>',
  '<a href="https://www.facebook.com/sharer.php?u=' + encodedUrl + '" class="article-share-facebook" target="_blank" title="Facebook"></a>',
  '<a href="#qrcode" class="article-share-qrcode" title="QRcode"></a>',
  '<a href="https://twitter.com/intent/tweet?url=' + encodedUrl + '" class="article-share-twitter" target="_blank" title="Twitter"></a>',
  '<a href="http://service.weibo.com/share/share.php?title='+title+'&url='+encodedUrl +'&ralateUid='+ tsina +'&searchPic=true&style=number' +'" class="article-share-weibo" target="_blank" title="Weibo"></a>',
  '<span title="Share to"></span>'
  ].join('');
  $this.append(html);
  $('.article-share-qrcode').click(function(){
    var imgSrc = $('#qrcode-pic').attr('data-src');
    $('#qrcode-pic').attr('src', imgSrc);
    $('#qrcode-pic').load(function(){
        $('.qrcode strong').text(' ');
    });
  });
});     
</script>









  </body>
</html>

